crates.io/cranelift-codegen CVE-2022-31146: medium 6.4, EPSS 1.25%

Wasmtime vulnerable to Use After Free with `externref`s

Action: Upgrade cranelift-codegen to 0.85.2 or later.

cargo update -p cranelift-codegen --precise 0.85.2

Affected

Fixed versions

Sources

• osv: GHSA-5fhj-g3p3-pq9g#crates.io/cranelift-codegen
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5fhj-g3p3-pq9g
• https://nvd.nist.gov/vuln/detail/CVE-2022-31146
• https://github.com/bytecodealliance/wasmtime/commit/2ba4bce5cc719e5a74e571a534424614e62ecc41
• https://github.com/WebAssembly/reference-types
• https://github.com/bytecodealliance/wasmtime
• https://rustsec.org/advisories/RUSTSEC-2022-0100.html

CVE-2022-31146 · published 2022-07-20T22:47:13Z · modified 2025-05-02T12:48:59Z · JSON